A phone holds your banking apps, chats and logins. Here's why simple deletion falls short, and how to prepare an Android or iPhone properly before selling or recycling it.
Most of us prepare an old phone the same way: delete some photos, clear a few chats and hand it over. It feels thorough. But a phone that has held banking apps, work email and years of private messages needs more than a tidy-up. The important difference is between making a phone look empty and properly removing your personal information from it.
Why Deleting Files Isn't Enough
Deleting individual files is not the same as securely sanitizing an entire device. Modern smartphones use encryption and other security protections, so deleted data on a current phone is not necessarily easy to recover. But manually deleting photos, messages or apps can still leave accounts, settings, authentication information or other personal data behind.
NIST defines media sanitization as a process that makes access to the target data infeasible for a given level of effort. Its guidelines also describe approaches such as cryptographic erase for securely removing data from appropriate storage systems.
For ordinary phone owners, that does not mean using specialist wiping software. The safer approach is to back up what you need, remove your accounts and use the manufacturer's built-in erase or factory-reset process.
What Older Android Phones Taught Us
A 2015 study from the University of Cambridge examined the security of Android factory resets. Researchers Laurent Simon and Ross Anderson tested 21 second-hand Android phones from five manufacturers and found weaknesses in the factory-reset process on the devices they examined. Their tests showed that some personal information could remain after a reset, including Google account credentials.
There is an important caveat: the phones in that study ran Android 2.3 through 4.3, versions that are now very old. Modern Android devices have much stronger security and encryption mechanisms.
So the study should not be read as evidence that today's Android phones routinely expose deleted data. Its more useful lesson is simpler: don't rely on manually deleting files. Use the device's proper reset process and remove your accounts before handing the phone to someone else.
Getting an iPhone Ready
Apple recommends backing up your information and transferring it to your new device before removing personal information from the old one. If an Apple Watch is paired with the iPhone, unpair it first.
On the iPhone, go to Settings → General → Transfer or Reset iPhone → Erase All Content and Settings. If the iPhone uses an eSIM, follow the option to erase the eSIM profile when prompted. Apple says that erasing the device removes information such as photos, contacts, apps and Apple Pay cards. It also turns off Find My and Activation Lock.
If you're moving from an iPhone to an Android phone, Apple also recommends deregistering iMessage so messages continue to reach your new device correctly.
If you no longer have the iPhone, Apple provides options through Find My and your Apple Account to secure or manage the device.
Getting an Android Ready
Android phones from different manufacturers have different menus, but the basic preparation is similar. Before resetting, back up your photos, contacts, messages and other important information, and move authenticator accounts and other security credentials to your new phone. Remove your Google Account from the device and remove manufacturer accounts, such as a Samsung account, where applicable. You should also remove the SIM card and any microSD card before handing the phone over.
After that, use the manufacturer's built-in Factory Reset option. Removing your Google Account before resetting is also useful because Android's Factory Reset Protection can require the previous owner's credentials after a reset. This is designed as an anti-theft feature, but it can create problems for a legitimate buyer if the previous owner leaves the account connected.
The exact location of the factory-reset option varies between manufacturers, so look under settings related to Reset, General Management or System.
Don't Forget the Data Around Your Phone
The phone itself isn't the only thing that needs attention. Before wiping it, transfer your authenticator apps, chat histories and other information you still need. Check that your banking and payment apps are set up on the new device. If you use a smartwatch or other accessories, unpair them where necessary.
Also check removable storage. If your phone has a microSD card, don't assume that a phone reset will erase everything stored on it. Remove the card and keep it, erase it separately or dispose of it securely.
Cloud accounts are different from the phone's local storage. Erasing the phone does not normally delete the information stored in your Google or Apple account. The goal is to remove your personal information and account access from the old device while keeping your cloud data available on your new one.
The Final Check
After the reset finishes, turn the phone on again. You should see the initial setup screen rather than your old apps, photos, messages or account information. This is a simple but useful final check before handing the device over.
Then check your Google or Apple account from another device and make sure the old phone is no longer connected where it shouldn't be.
If you're selling or exchanging the phone, use a reputable trade-in service, manufacturer programme or established recycler. If the device is badly damaged and you cannot reset it, tell the recycler so it can handle the device appropriately.
A phone may be old, but the information it contains can still be valuable. Deleting a few photos takes seconds. Properly preparing the entire device takes a little longer, but it can save you from a much bigger privacy problem later.